Paper2025
Material reviewed: AbstractThe authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageThe paper studies files uploaded by attackers to a cloud honeypot and uses them to compare signature-based detection by antivirus programs.
CloudHoneypot
Paper2025
Material reviewed: AbstractThe study analyzes malicious actors' patterns and tactics using a modified T-Pot Honeypot, with multiple honeypots in Docker containers emulating vulnerable services. It aims to collect and analyze exploitation, evasion and credential attempts to characterize threats and inform cyberdefense adjustments.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis work presents a longitudinal analysis of attacker behavior using HoneyTrap, an adaptive honeypot framework deployed across geographically distributed nodes to emulate vulnerable services. According to the authors, more than 60.3 million events were collected over a 24-day window, with data transformed into Parquet format for scalable analytics. The authors report that HTTP/HTTPS traffic and SSH brute-force attacks were predominant, alongside activity targeting less common services like Minecraft and SMB.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThe work addresses classifying CVE vulnerabilities by which are most frequently exploited, using data collected from a T-pot honeypot. The authors describe a data-collection and analysis plan using Elasticsearch, Kibana and Suricata, aimed at identifying vulnerabilities attractive to malicious actors and the risk they pose to Universidad Politécnica Estatal del Carchi.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes the design and implementation of an LLM-based honeypot simulating an LDAP server, a protocol critical to identity and access management in organizations. The proposed solution aims to offer a flexible and realistic tool capable of convincingly interacting with attackers, contributing to early detection and threat analysis.
IdentityNetworkHoneypot
Open software2025
Material reviewed: Repository metadataRepository about DNS simulation; documentation and maintenance require further review.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work introduces EtherBee, a global dataset integrating Ethereum node metrics, network traffic metadata, and honeypot interaction logs collected from ten geographically diverse vantage points over three months. The stated purpose is to correlate node data with network sessions and security events to study benign and malicious activity, node stability, and network-level threats, as well as a case study on geographic concentration from client optimizations.
NetworkHoneypot
Paper2025
Material reviewed: Public pageThe study evaluates LLMs for cybersecurity tasks, including honeypot generation, combining knowledge questions with automated assessment of security artifacts.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis work uses HackIT, a cybersecurity simulation tool, and a human-subject experiment with 88 computer science students to examine how attacker behavior varies across network topologies (ring vs. star) and honeypot densities (50% vs. 75%). The reported outcomes indicate that increased honeypot density maximized decoy interaction but also led to more real-system attacks in centralized (star) networks, whereas decentralized (ring) networks were more robust with fewer honeypots.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Full textBibliographic record on honeypot integration in industrial IoT. The abstract and findings still require review.
OT/ICSHoneypot
Open software2025
Material reviewed: Public pageGenPot is a generative honeypot architecture integrating fine-tuned language models, OpenCanary HTTP skins and a FastAPI service for deployment, evaluation and research. It is an educational and experimental project.
NetworkHoneypot
Open software2025
Material reviewed: Repository metadataHellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.
ApplicationHoneypot
Open software2025
Material reviewed: Repository metadataSignature based honeypot detector tool written in Golang
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose HoneyFL, a run-time defense against diverse backdoor attacks in federated learning that uses honeypot clients and differential prediction to handle adaptive attacks. The work reports comparative experiments against five state-of-the-art defense baselines, with detection and false-positive rates reported by the authors and an impact on main-task aggregation described as negligible.
Honeypot
Dataset or lab2025
Material reviewed: Public pageCritical readingCSV of seven days of Suricata events from T-Pot, according to the Zenodo record.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Open software2025
Material reviewed: Repository metadataAn uploader honeypot designed to look like poor website security.
ApplicationHoneypot
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2025
Material reviewed: AbstractThis paper presents the implementation of a honeynet in which a honeypot acts as a real resource within a production network environment, aiming to divert and mislead attackers and analyze their behavior. According to the authors, the honeypot mimics both scanners and attackers within a simulated, production-level environment.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageProposal describing the addition of a CamouflageNet honeynet and machine learning techniques into the SCADA architecture of an ICS system, aiming to improve defense and the ability to gather information about attackers.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.
NetworkEndpointHoneypotDecoy
Dataset or lab2025
Material reviewed: Public pageCritical readingData from a T-Pot honeynet spread across Azure regions, according to its Zenodo record.
CloudHoneypot